GitHub Advisoryadvisory · npm

GHSA-g8m7-qhv7-9h5x Path Traversal in serve-here.js

HIGH Published 2019-07-05 Modified 2021-09-22 Official page ↗
Ecosystem
npm
Packages
serve-here
Severity
High
Weaknesses
CWE-22
Reviewed
2019-06-14

Affected packages

• npm serve-here: <= 3.2.0 (no fix yet)

Description

Versions of `serve-here.js` prior to 1.2.0 are vulnerable to Path Traversal. The package fails to sanitize URLs, allowing attackers to access server files outside of the served folder using relative paths. Recommendation Upgrade to version 1.2.0 or later.

Related

Weakness · CWE (1)

  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory weakness

References